<div dir="ltr">I haven't got chance to measure if the fix is effective or not yet. I have start measuring the CPU spikes in this week after putting in the fix for scan_udp.bro. I should have some results in a couple of days. <div>
<br></div><div><br>Aashish </div><div><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Feb 18, 2014 at 2:19 PM, Jon Siwek (JIRA) <span dir="ltr"><<a href="mailto:jira@bro-tracker.atlassian.net" target="_blank">jira@bro-tracker.atlassian.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
[ <a href="https://bro-tracker.atlassian.net/browse/BIT-1138?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15561#comment-15561" target="_blank">https://bro-tracker.atlassian.net/browse/BIT-1138?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15561#comment-15561</a> ]<br>
<br>
Jon Siwek commented on BIT-1138:<br>
--------------------------------<br>
<br>
This was from a custom script that Aashish was running, not something distributed w/ Bro?<br>
<br>
But yeah, I don't recall if we found out if the suggestions helped.<br>
<div class=""><br>
> UDP scan detection generates a large number of triggers<br>
</div>> -------------------------------------------------------<br>
<div class="HOEnZb"><div class="h5">><br>
> Key: BIT-1138<br>
> URL: <a href="https://bro-tracker.atlassian.net/browse/BIT-1138" target="_blank">https://bro-tracker.atlassian.net/browse/BIT-1138</a><br>
> Project: Bro Issue Tracker<br>
> Issue Type: Problem<br>
> Components: Bro<br>
> Reporter: Robin Sommer<br>
> Fix For: 2.3<br>
><br>
><br>
> These triggers then cause high CPU load. We had a fix already but I'm not sure if it has been confirmed that it solved the problem?<br>
<br>
<br>
<br>
--<br>
This message was sent by Atlassian JIRA<br>
(v6.2-OD-09-036#6252)<br>
_______________________________________________<br>
bro-dev mailing list<br>
<a href="mailto:bro-dev@bro.org">bro-dev@bro.org</a><br>
<a href="http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev" target="_blank">http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev</a><br>
</div></div></blockquote></div><br></div>